syzbot
INFO: task hung in d_alloc_parallel (2)
Status:
upstream: reported C repro on 2024/11/04 12:30
Bug presence:
origin:lts-only
[Documentation on labels]
Reported-by: syzbot+30f73869d6de512e814b@syzkaller.appspotmail.com
First crash: 649d, last: 1d07h
▶
▼
Bug presence (2)
| Date |
Name |
Commit |
Repro |
Result |
| 2024/11/09 |
linux-6.1.y (ToT) |
d7039b844a1c |
C
|
[report] INFO: task hung in d_alloc_parallel
|
| 2024/11/09 |
upstream (ToT) |
da4373fbcf00 |
C
|
Didn't crash |
▶
▼
Fix bisection attempts (4)
Sample crash report:
INFO: task syz.0.17:4547 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17 state:D stack:0 pid:4547 ppid:4469 flags:0x00000001
Call trace:
__switch_to+0x2f4/0x550 arch/arm64/kernel/process.c:555
context_switch kernel/sched/core.c:5246 [inline]
__schedule+0xdb4/0x1a6c kernel/sched/core.c:6563
schedule+0xc4/0x170 kernel/sched/core.c:6639
d_wait_lookup+0x168/0x240 fs/dcache.c:2634
d_alloc_parallel+0x9cc/0x1178 fs/dcache.c:2716
__lookup_slow+0x114/0x38c fs/namei.c:1683
lookup_slow+0x60/0x84 fs/namei.c:1715
walk_component fs/namei.c:2006 [inline]
link_path_walk+0x818/0xcd8 fs/namei.c:2333
path_openat+0x1c0/0x27a0 fs/namei.c:3787
do_filp_open+0x198/0x38c fs/namei.c:3818
do_sys_openat2+0x134/0x3fc fs/open.c:1320
do_sys_open fs/open.c:1336 [inline]
__do_sys_openat fs/open.c:1352 [inline]
__se_sys_openat fs/open.c:1347 [inline]
__arm64_sys_openat+0x11c/0x150 fs/open.c:1347
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
INFO: task syz.1.18:4550 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.18 state:D stack:0 pid:4550 ppid:4468 flags:0x00000001
Call trace:
__switch_to+0x2f4/0x550 arch/arm64/kernel/process.c:555
context_switch kernel/sched/core.c:5246 [inline]
__schedule+0xdb4/0x1a6c kernel/sched/core.c:6563
schedule+0xc4/0x170 kernel/sched/core.c:6639
d_wait_lookup+0x168/0x240 fs/dcache.c:2634
d_alloc_parallel+0x9cc/0x1178 fs/dcache.c:2716
__lookup_slow+0x114/0x38c fs/namei.c:1683
lookup_slow+0x60/0x84 fs/namei.c:1715
walk_component fs/namei.c:2006 [inline]
link_path_walk+0x818/0xcd8 fs/namei.c:2333
path_openat+0x1c0/0x27a0 fs/namei.c:3787
do_filp_open+0x198/0x38c fs/namei.c:3818
do_sys_openat2+0x134/0x3fc fs/open.c:1320
do_sys_open fs/open.c:1336 [inline]
__do_sys_openat fs/open.c:1352 [inline]
__se_sys_openat fs/open.c:1347 [inline]
__arm64_sys_openat+0x11c/0x150 fs/open.c:1347
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
INFO: task syz.4.21:4557 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.21 state:D
stack:0 pid:4557 ppid:4482 flags:0x00000001
Call trace:
__switch_to+0x2f4/0x550 arch/arm64/kernel/process.c:555
context_switch kernel/sched/core.c:5246 [inline]
__schedule+0xdb4/0x1a6c kernel/sched/core.c:6563
schedule+0xc4/0x170 kernel/sched/core.c:6639
d_wait_lookup+0x168/0x240 fs/dcache.c:2634
d_alloc_parallel+0x9cc/0x1178 fs/dcache.c:2716
__lookup_slow+0x114/0x38c fs/namei.c:1683
lookup_slow+0x60/0x84 fs/namei.c:1715
walk_component fs/namei.c:2006 [inline]
link_path_walk+0x818/0xcd8 fs/namei.c:2333
path_openat+0x1c0/0x27a0 fs/namei.c:3787
do_filp_open+0x198/0x38c fs/namei.c:3818
do_sys_openat2+0x134/0x3fc fs/open.c:1320
do_sys_open fs/open.c:1336 [inline]
__do_sys_openat fs/open.c:1352 [inline]
__se_sys_openat fs/open.c:1347 [inline]
__arm64_sys_openat+0x11c/0x150 fs/open.c:1347
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
INFO: task syz.3.20:4558 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.20 state:D stack:0 pid:4558 ppid:4481 flags:0x00000001
Call trace:
__switch_to+0x2f4/0x550 arch/arm64/kernel/process.c:555
context_switch kernel/sched/core.c:5246 [inline]
__schedule+0xdb4/0x1a6c kernel/sched/core.c:6563
schedule+0xc4/0x170 kernel/sched/core.c:6639
d_wait_lookup+0x168/0x240 fs/dcache.c:2634
d_alloc_parallel+0x9cc/0x1178 fs/dcache.c:2716
__lookup_slow+0x114/0x38c fs/namei.c:1683
lookup_slow+0x60/0x84 fs/namei.c:1715
walk_component fs/namei.c:2006 [inline]
link_path_walk+0x818/0xcd8 fs/namei.c:2333
path_openat+0x1c0/0x27a0 fs/namei.c:3787
do_filp_open+0x198/0x38c fs/namei.c:3818
do_sys_openat2+0x134/0x3fc fs/open.c:1320
do_sys_open fs/open.c:1336 [inline]
__do_sys_openat fs/open.c:1352 [inline]
__se_sys_openat fs/open.c:1347 [inline]
__arm64_sys_openat+0x11c/0x150 fs/open.c:1347
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
INFO: task syz.2.19:4559 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.19 state:D stack:0 pid:4559 ppid:4475 flags:0x00000001
Call trace:
__switch_to+0x2f4/0x550 arch/arm64/kernel/process.c:555
context_switch kernel/sched/core.c:5246 [inline]
__schedule+0xdb4/0x1a6c kernel/sched/core.c:6563
schedule+0xc4/0x170 kernel/sched/core.c:6639
d_wait_lookup+0x168/0x240 fs/dcache.c:2634
d_alloc_parallel+0x9cc/0x1178 fs/dcache.c:2716
__lookup_slow+0x114/0x38c fs/namei.c:1683
lookup_slow+0x60/0x84 fs/namei.c:1715
walk_component fs/namei.c:2006 [inline]
link_path_walk+0x818/0xcd8 fs/namei.c:2333
path_openat+0x1c0/0x27a0 fs/namei.c:3787
do_filp_open+0x198/0x38c fs/namei.c:3818
do_sys_openat2+0x134/0x3fc fs/open.c:1320
do_sys_open fs/open.c:1336 [inline]
__do_sys_openat fs/open.c:1352 [inline]
__se_sys_openat fs/open.c:1347 [inline]
__arm64_sys_openat+0x11c/0x150 fs/open.c:1347
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Showing all locks held in the system:
5 locks held by kworker/u4:0/9:
#0:
ffff0000c0845138 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
#1: ffff80001cb37c40 (net_cleanup_work){+.+.}-{0:0}
, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
#2: ffff8000179f85d0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x144/0xa90 net/core/net_namespace.c:594
#3: ffff800017a04e48 (rtnl_mutex){+.+.}-{3:3}
, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74
#4:
ffff0000c3ca5a80 (&caifn->caifdevs.lock){+.+.}-{3:3}, at: caif_exit_net+0x88/0x53c net/caif/caif_dev.c:528
1 lock held by rcu_tasks_kthre/12:
#0: ffff800015557db0 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x40/0xc48 kernel/rcu/tasks.h:517
1 lock held by rcu_tasks_trace/13:
#0: ffff8000155585d0 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x40/0xc48 kernel/rcu/tasks.h:517
1 lock held by khungtaskd/28:
#0: ffff800015557440 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0xc/0x44 include/linux/rcupdate.h:349
3 locks held by kworker/u4:4/1586:
#0:
ffff0000c0029138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
#1: ffff800025227c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
#2: ffff800017a04e48 (rtnl_mutex){+.+.}-{3:3}
, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74
2 locks held by udevd/3940:
2 locks held by getty/4083:
#0:
ffff0000d6729098 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c drivers/tty/tty_ldsem.c:340
#1: ffff80001fa032f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x2e8/0xfa8 drivers/tty/n_tty.c:2198
3 locks held by kworker/0:7/4463:
#0: ffff0000d5d31938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
#1: ffff800020ec7c40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
#2:
ffff800017a04e48
(
rtnl_mutex
){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74
3 locks held by kworker/0:9/4515:
#0:
ffff0000c0020938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
#1: ffff800021077c40 (fqdir_free_work
){+.+.}-{0:0}
, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
#2:
ffff80001555cfc0 (rcu_state.barrier_mutex){+.+.}-{3:3}, at: rcu_barrier+0x58/0x5b8 kernel/rcu/tree.c:4023
1 lock held by syz.0.17/4546:
1 lock held by syz.0.17/4547:
#0:
ffff0000f76a8198 (&type->i_mutex_dir_key#8){.+.+}-{3:3}
, at: inode_lock_shared include/linux/fs.h:768 [inline]
, at: lookup_slow+0x50/0x84 fs/namei.c:1714
1 lock held by syz.1.18/4549:
1 lock held by syz.1.18/4550:
#0: ffff0000f76a8c48 (&type->i_mutex_dir_key#8){.+.+}-{3:3}, at: inode_lock_shared include/linux/fs.h:768 [inline]
#0: ffff0000f76a8c48 (&type->i_mutex_dir_key#8){.+.+}-{3:3}, at: lookup_slow+0x50/0x84 fs/namei.c:1714
1 lock held by syz.4.21/4552:
1 lock held by syz.4.21/4557:
#0:
ffff0000f7648198
(
&type->i_mutex_dir_key
#8
){.+.+}-{3:3}, at: inode_lock_shared include/linux/fs.h:768 [inline]
){.+.+}-{3:3}, at: lookup_slow+0x50/0x84 fs/namei.c:1714
1 lock held by syz.3.20/4554:
1 lock held by syz.3.20/4558:
#0: ffff0000f76a96f8 (&type->i_mutex_dir_key
#8
){.+.+}-{3:3}, at: inode_lock_shared include/linux/fs.h:768 [inline]
){.+.+}-{3:3}, at: lookup_slow+0x50/0x84 fs/namei.c:1714
1 lock held by syz.2.19/4556:
1 lock held by syz.2.19/4559:
#0: ffff0000f76aa1a8 (&type->i_mutex_dir_key#8){.+.+}-{3:3}, at: inode_lock_shared include/linux/fs.h:768 [inline]
#0: ffff0000f76aa1a8 (&type->i_mutex_dir_key#8){.+.+}-{3:3}, at: lookup_slow+0x50/0x84 fs/namei.c:1714
1 lock held by syz.6.23/4681:
1 lock held by syz.6.23/4682:
#0: ffff0000f7648c48 (&type->i_mutex_dir_key#8){.+.+}-{3:3}, at: inode_lock_shared include/linux/fs.h:768 [inline]
#0: ffff0000f7648c48 (&type->i_mutex_dir_key#8){.+.+}-{3:3}, at: lookup_slow+0x50/0x84 fs/namei.c:1714
1 lock held by syz.8.25/4685:
1 lock held by syz.8.25/4688:
#0: ffff0000f76496f8 (&type->i_mutex_dir_key#8){.+.+}-{3:3}, at: inode_lock_shared include/linux/fs.h:768 [inline]
#0: ffff0000f76496f8 (&type->i_mutex_dir_key#8){.+.+}-{3:3}, at: lookup_slow+0x50/0x84 fs/namei.c:1714
4 locks held by syz.5.22/4687:
1 lock held by syz.5.22/4691:
#0: ffff0000f764a1a8 (&type->i_mutex_dir_key
#8){.+.+}-{3:3}, at: inode_lock_shared include/linux/fs.h:768 [inline]
#8){.+.+}-{3:3}, at: lookup_slow+0x50/0x84 fs/namei.c:1714
1 lock held by syz.9.26/4690:
1 lock held by syz.9.26/4692:
#0: ffff0000f764ac58 (&type->i_mutex_dir_key#8){.+.+}-{3:3}, at: inode_lock_shared include/linux/fs.h:768 [inline]
#0: ffff0000f764ac58 (&type->i_mutex_dir_key#8){.+.+}-{3:3}, at: lookup_slow+0x50/0x84 fs/namei.c:1714
1 lock held by syz.7.24/4695:
1 lock held by syz.7.24/4696:
#0: ffff0000f764b708 (&type->i_mutex_dir_key#8){.+.+}-{3:3}, at: inode_lock_shared include/linux/fs.h:768 [inline]
#0: ffff0000f764b708 (&type->i_mutex_dir_key#8){.+.+}-{3:3}, at: lookup_slow+0x50/0x84 fs/namei.c:1714
1 lock held by syz-executor/10132:
#0: ffff800017a04e48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffff800017a04e48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x64c/0xcc4 net/core/rtnetlink.c:6163
=============================================
* Struck through repros no longer work on HEAD.